Digest · Friday

Security digest: October 25, 2024

4 critical advisories.

Take stock

Go: 4 critical advisories (github.com/rancher/rke2, github.com/rancher/rancher, github.com/crossplane/crossplane). Check with govulncheck ./....
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Check: govulncheck ./...

RKE2 allows privilege escalation in Windows nodes due to Insecure Access Control Lists GHSA-x7xj-jvwp-97rv CVSS 9.1 Critical
github.com/rancher/rke2 >= 1.27.0, < 1.27.15 → fixed in 1.27.15; github.com/rancher/rke2 >= 1.28.0, < 1.28.11 → fixed in 1.28.11; github.com/rancher/rke2 >= 1.29.0, < 1.29.6 → fixed in 1.29.6; +1 more packages
Rancher Remote Code Execution via Cluster/Node Drivers CVE-2024-22036 CVSS 9.1 Critical
github.com/rancher/rancher >= 2.7.0, < 2.7.16 → fixed in 2.7.16; github.com/rancher/rancher >= 2.8.0, < 2.8.9 → fixed in 2.8.9; github.com/rancher/rancher >= 2.9.0, < 2.9.3 → fixed in 2.9.3
Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists CVE-2023-32197 CVSS 9.4 Critical
github.com/rancher/rancher >= 2.7.0, < 2.8.9 → fixed in 2.8.9; github.com/rancher/rancher >= 2.9.0, < 2.9.3 → fixed in 2.9.3
github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses GHSA-7h65-4p22-39j6 CVSS 9.8 Critical
github.com/crossplane/crossplane = 1.15.5 → fixed in 1.15.6; github.com/crossplane/crossplane = 1.16.2 → fixed in 1.16.3; github.com/crossplane/crossplane = 1.17.1 → fixed in 1.17.2